# How to apply different filters based on particular name of files without using Filebeat

**URL:** <https://discuss.elastic.co/t/how-to-apply-different-filters-based-on-particular-name-of-files-without-using-filebeat/186272>\
**Category:** Logstash\
**Created:** [June 18, 2019, 1:54pm UTC](https://discuss.elastic.co/t/how-to-apply-different-filters-based-on-particular-name-of-files-without-using-filebeat/186272 "2019-06-18T13:54:34Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![dundundundun](https://avatars.discourse-cdn.com/v4/letter/d/87869e/32.png) [@dundundundun](https://discuss.elastic.co/u/dundundundun)\
**Post date:** [June 18, 2019, 1:54pm UTC](https://discuss.elastic.co/t/how-to-apply-different-filters-based-on-particular-name-of-files-without-using-filebeat/186272/1 "2019-06-18T13:54:34Z")

</div>

I want to perform a unique grok filter per log. So let's say for 1.log I want to perform filter A, 2.log I want filter B, and so on. I've copied my input section in the logstash configuration file with psuedo code in the filter section that I am asking about. Thanks in advance!

```
input {
       file {
		path => "/home/joseph/logs/1.log"
		path => "/home/joseph/logs/2.log"
		path => "/home/joseph/logs/3.log"
		path => "/home/joseph/logs/4.log"
        // in reality, we have path => "/home/joseph/logs/*"
       start_position => "beginning"
	}
}

filter {
	//if name of file is 1.log {
		// filter A
	}
	//if name of file is 2.log {
		// filter B
	}
	//if name of file is 3.log {
		// filter C
	}
	//if name of file is 4.log {
		// filter D
	}
}
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 18, 2019, 2:07pm UTC](https://discuss.elastic.co/t/how-to-apply-different-filters-based-on-particular-name-of-files-without-using-filebeat/186272/2 "2019-06-18T14:07:25Z")

</div>

The file input adds a path field to every event, so you could test

```
if [path] == "/home/joseph/logs/1.log"

```

or even

```
if [path] =~ /\/1.log$/
```

---

<div class="post-metadata">

**Author:** ![dundundundun](https://avatars.discourse-cdn.com/v4/letter/d/87869e/32.png) [@dundundundun](https://discuss.elastic.co/u/dundundundun)\
**Post date:** [June 18, 2019, 3:04pm UTC](https://discuss.elastic.co/t/how-to-apply-different-filters-based-on-particular-name-of-files-without-using-filebeat/186272/3 "2019-06-18T15:04:20Z")

</div>

Thank you! So I can use the grok match filter on the path as well? It doesn't seem to be pattern matching correctly for me. Even when I simply match "path" to %{GREEDYDATA}, I am getting a \_grokparsefailure

```
filter {
        grok {
                match => {
                       "path" => "%{GREEDYDATA}%{SYSID:sysid}%{KEYWORD:keyword}"     
                }
                pattern_definitions => {
                                 "SYSID" => "[\w]{1}"
                                "KEYWORD" => ".log"

                }
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 18, 2019, 3:27pm UTC](https://discuss.elastic.co/t/how-to-apply-different-filters-based-on-particular-name-of-files-without-using-filebeat/186272/4 "2019-06-18T15:27:06Z")

</div>

With [path] set to "/home/joseph/logs/1.log" that grok works just fine for me. However, I would write it differently. There is no need for the initial %{GREEDYDATA} since the pattern is not anchored to the start of the field. Also, I would anchor it to the end of the field. Also, \w is already a character class, so there is no need for [and] around it.

```
    grok {
        match => { "path" => "%{SYSID:sysid}\.log$" }
        pattern_definitions => { "SYSID" => "\w{1}" }
    }

```

But regardless of the stylistic points, your grok works just fine for me, so I am not sure what the issue is.

---

<div class="post-metadata">

**Author:** ![dundundundun](https://avatars.discourse-cdn.com/v4/letter/d/87869e/32.png) [@dundundundun](https://discuss.elastic.co/u/dundundundun)\
**Post date:** [June 18, 2019, 7:00pm UTC](https://discuss.elastic.co/t/how-to-apply-different-filters-based-on-particular-name-of-files-without-using-filebeat/186272/5 "2019-06-18T19:00:19Z")

</div>

Thank you for the cleaner code! I'm definitely still curious why it isn't working on my end...  
Update: I needed the $ at the end of the line

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 16, 2019, 7:00pm UTC](https://discuss.elastic.co/t/how-to-apply-different-filters-based-on-particular-name-of-files-without-using-filebeat/186272/6 "2019-07-16T19:00:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.